[cschanhniem]

Implements J7 from NEXT_100_PR_MAP: contributor covenant and attribution policy.

What

• docs/CONTRIBUTOR_COVENANT.md: 7 sections
• Pledge: harassment-free, scientifically rigorous environment
• Standards: expected behavior + unacceptable behavior (6 items each)
• Unacceptable behavior explicitly includes: overclaiming dry-lab results as biological proof, weakening safety constraints without human review, forging evidence artifacts
• Attribution policy: git authorship as primary record, CONTRIBUTORS.md for major contributors
• Artifact attribution: CERT-/RMF-/BMC- record pipeline version + commit SHA, NOT individual contributor names (deliberate separation)
• AI/agent contribution policy: agent commits attributed to agent, human reviewer is responsible maintainer of record
• Adapted from Contributor Covenant 2.1
• Docs-only PR; no code changes

Why

Without an explicit conduct document, the project is vulnerable to: (1) overclaiming in PR discussions, (2) no standard for handling safety-constraint weakening, (3) ambiguity about AI-authored commits. The overclaiming prohibition in the conduct document means it is a covenant violation — not just a code style issue — to present dry-lab outputs as biological proof.

Disconfirming pass

• Overclaiming is listed as unacceptable behavior, not merely discouraged
• Safety constraint weakening requires explicit human review sign-off (named in conduct, not just in AGENTS.md)
• Agent attribution policy prevents individual credit inflation